OTP bots: how one-time passcode interception works
An OTP bot is automation that tricks people into handing over one-time passcodes, or that drives signup and login flows so OTPs are issued at scale. Attackers use it in account takeover and promo farming. Defenders slow it with bot detection, device linking, OTP rate limits, phishing-resistant login options and risk scoring on the sessions that request codes.
Updated · RiskCogs team
Key facts
- OTP bots appear in two main forms: social-engineering relays that ask victims for codes, and automated clients that trigger mass OTP sends.
- SMS one-time codes are convenient and widely phished; app-based or hardware factors resist relay attacks better.
- High code-send velocity per phone, device or IP is a practical early warning.
- Stopping this abuse is a mix of bot controls, messaging limits and stronger authentication options.
What is an OTP bot?
OTP means one-time password or one-time passcode. An OTP bot is software that either intercepts those codes through social engineering or automation, or burns through your SMS and email gateways by requesting codes at machine speed.
In account takeover, a common pattern is a fake login or support page that asks the victim for the code your real site just sent. In abuse farming, bots open many accounts and consume passcode quota without a human in the loop.
How OTP interception attacks work
- Attacker starts login or reset on the real site with a stolen username.
- The real site sends an SMS or email OTP to the victim.
- A fake page or call asks the victim to read the code aloud or type it in.
- The bot or operator submits the code to the real site and takes the session.
- Optional: the same tooling requests many OTPs to exhaust limits or hide the attack.
Signals of OTP bot activity
- Spike in code sends per phone number, device or IP.
- Many passcode requests with few successful logins.
- Automation or emulator signals on the session that requested the code.
- New devices approving high-risk actions right after a passcode.
- Passcode traffic from data-center or known relay infrastructure.
How to reduce OTP bot damage
- Rate-limit OTP sends per phone, email, device and IP.
- Add bot detection before the send step, not only after failure.
- Prefer app-based or phishing-resistant factors for high-risk actions.
- Warn users that support will never ask them to read an SMS code aloud.
- Score the session that requests and consumes the code with device and network context.
- Monitor gateway cost and delivery failure rates for pumping patterns.
OTP threats and first controls
| Pattern | Goal | First control |
|---|---|---|
| Relay / social engineering | Steal a real user code | User education; phishing-resistant MFA |
| Automated OTP requests | Account farming or gateway drain | Bot checks + send rate limits |
| SIM-related attacks | Divert SMS | Avoid SMS as sole factor for high risk |
| ATO after OTP success | Take over account | Device linking; step-up on new device |
How RiskCogs fits next to OTP controls
RiskCogs does not send or validate OTP messages. It scores the payment or account event with device, network and history signals, including automation traces from the consenting browser SDK, so sessions that request sensitive actions can be reviewed or stepped up.
Use RiskCogs beside your identity provider and messaging gateway. It is a risk scoring layer next to your payment provider and does not process payments. See the pricing page for current plans.
See what you would have blocked — free shadow modeFrequently asked questions
What does OTP bot mean?
An OTP bot is automation used to steal one-time passcodes or to request them at scale. Some bots relay codes from victims who think they are talking to support. Others hit signup and login endpoints so your SMS or email gateway issues thousands of codes. Both patterns show up in account takeover and abuse farming.
How do OTP bots steal codes?
A common path is a fake login page or phone call that asks the victim for the code your real service just sent. The attacker submits that code before it expires. Other bots simply trigger mass OTP sends to raise cost or hide a takeover. Device and velocity signals help spot the automated side of the attack.
Is SMS OTP safe enough for payments?
SMS OTP is better than passwords alone and still widely phished. For high-risk actions, many teams add app-based codes, passkeys or step-up checks on new devices. Risk scoring on the session that requests the code adds context SMS alone cannot see.
How can I stop OTP pumping on my signup?
Put bot detection and rate limits in front of the send call, cap OTPs per phone and per device, and watch gateway spend for sudden spikes. Link devices across accounts so farming with new emails still shares a durable signal. Test stricter limits in shadow or monitor mode before hard blocks.
Sources and related reading
- OWASP and NCSC public guidance on phishing of one-time passcodes — named as text sources only.